It seems to have suddenly become a major problem in the last week or so. Now about 90% of our spam is hosted through cloudflare. Reporting the spams doesn't help -- the domains are never removed from cloudflare. Cloudflare themselves don't really seem to give a crap...lots of people complaining to them on twitter, but they don't seem to care. They just say they're not hosting it, and direct people to report it via the web form (which they then just ignore).
I just implemented a change to our spam filter yesterday, which has completely resolved the issue: I now block all emails coming from domains registered less than 7 days ago. (I don't specifically check for hosting on cloudflare, as this should kill spams from elsewhere as well). If anyone wants the perl function, let me know.